How RFID Tags Are Made: RAIN Inlays, Chips, EPC Gen2 and Privacy

A UHF RFID tag is made by bonding a tiny passive chip to a thin metal antenna on a plastic film, which forms an inlay, then laminating that inlay into a label and writing an Electronic Product Code (EPC) into it. The chip has no battery: it harvests energy from the reader's radio wave and answers by reflecting part of that wave back, a trick called backscatter.

Those tags speak the GS1 EPC Gen2 air interface (harmonised with ISO/IEC 18000-63), marketed as RAIN RFID, and carry identities defined by the GS1 EPC Tag Data Standard. This post follows a tag from wafer to labelled item, explains the protocol and identity format, works the radio rules with real numbers, and covers what an EPC does not prove and how tags can track people after checkout.

It sits next to our explainers on NFC, ISO 14443, NDEF and relay attacks, which covers 13.56 MHz cards and phones, and how semiconductors are made from sand to chip.

Key takeaways

• A passive UHF tag is a chip die and an antenna on a substrate (an inlay), laminated into a label.
• The reader's carrier powers the chip, which answers by switching its antenna load: backscatter.
• GS1's Gen2 standard was first published by EPCglobal in 2004. Release 3.0 (Gen2v3) arrived in 2023 and the current text is Release 3.0.1, ratified in February 2026.
• Gen2 tag memory has four banks: Reserved (kill and access passwords), EPC, TID and optional User memory. Both passwords are 32 bits and default to zero.
• An EPC is a label, not a credential. It can be copied, so never use it alone to prove an item is genuine.
• Privacy and security controls include Kill (permanent), Untraceable (hide memory or shrink range) and Authenticate with ISO/IEC 29167 suites. All but Kill are optional.
• In the United States, readers in 902 to 928 MHz are limited to 1 W conducted with up to 6 dBi of antenna gain under 47 CFR 15.247. In Europe, ETSI EN 302 208 allows up to 2 W e.r.p. in 865 to 868 MHz and up to 4 W e.r.p. in 915 to 921 MHz.
• Readers are networked computers. LLRP, the GS1 reader protocol, uses TCP port 5084 by default and 5085 for TLS.

From wafer to labelled item: the step table

How do RFID families differ?

"RFID" covers several unrelated radio systems. The useful split is by frequency band, then by power source.

Low frequency, 125 to 134 kHz

Low frequency (LF) tags couple to the reader magnetically through a coil. Range is short and data rates slow, but the signal tolerates water and tissue, so LF dominates animal identification, older access badges and car immobilisers. Many LF badges carry a fixed identifier with no cryptography, which makes them easy to copy.

High frequency, 13.56 MHz: NFC and ISO 15693

High frequency (HF) tags also couple magnetically. ISO/IEC 14443 proximity cards and NFC work within a few centimetres and many support real cryptography: payment cards, transit cards and passports live here. ISO/IEC 15693 vicinity tags read further and are common in libraries.

Ultra high frequency, 860 to 960 MHz: RAIN RFID

UHF tags work by radiative coupling: the antenna is a dipole style radiator, and the reader's wave propagates to the tag over metres rather than centimetres. GS1 describes its EPC Gen2 air interface as the standard for UHF passive RFID, "aka RAIN RFID," and the Gen2 specification itself covers communications at 860 to 930 MHz. NIST SP 800-98 notes that Gen2 tags operate across 860 to 960 MHz while each region permits only a slice, for example 902 to 928 MHz in the United States. The RAIN Alliance is the industry body that promotes the brand and the ecosystem around Gen2.

The tradeoff is physics. UHF waves reflect off metal and are absorbed by water, so a tag tuned for cardboard can fail on a bottle of shampoo. The RAIN Alliance's tag page makes this point: antennas are tuned for the material they sit on.

Passive, battery assisted and active

A battery assisted passive (BAP) tag runs its chip from a small battery, so it wakes in weaker fields, but still answers by backscatter; the RAIN Alliance lists "battery assist" among optional chip features. An active tag has its own transmitter and reaches much further, at higher cost. NIST SP 800-98 cites ISO/IEC 18000-7, an active protocol at 433 MHz with a 32 bit tag ID and an optional 32 bit password.

Comparison table: band, range, standard, use and security

Ranges are indicative and vary with reader power, antennas and the tagged item.

What is inside a passive UHF tag?

Peel an apparel hang tag apart and you find PET film with a flat metal antenna pattern. Where the antenna's arms meet sits a black dot: the chip.

The parts and their names

• Chip die. A complete integrated circuit with a radio front end, a small controller and non volatile memory, with no package around it. Tag chip dies are a small fraction of a millimetre across, far smaller than the antenna they drive; die sizes vary by design and chip makers publish them per product.
• Antenna. Usually aluminium, sometimes copper or printed silver ink, shaped as a folded dipole or meander line so it resonates near the band centre while fitting the label. A matching loop near the chip tunes the antenna's impedance to the chip's, which is capacitive.
• Strap (or interposer). Some processes mount the die on a small carrier with larger pads, then attach that strap to the antenna.
• Substrate. Usually PET film; paper is used in some applications.
• Inlay. Chip plus antenna on substrate. A dry inlay has no adhesive; a wet inlay has adhesive and a liner so it can be applied directly.
• Face stock and adhesive. Converting adds printable paper or film on top and adhesive with a liner below, so a printer can print and encode the label in one pass.

How backscatter powers the chip and carries data

The reader transmits a carrier. The tag antenna captures a little of it, and a rectifier on the chip turns it into a small DC supply that wakes the logic.

Commands travel from reader to tag as dips in the carrier's amplitude. The Gen2 specification says interrogators modulate the carrier using double sideband, single sideband or phase reversal amplitude shift keying (DSB-ASK, SSB-ASK or PR-ASK), with pulse interval encoding, and that tags "receive their operating energy from this same modulated RF carrier."

To answer, the reader sends an unmodulated carrier and listens. The tag toggles a transistor across its antenna terminals, switching the load between two states that reflect different amounts, or phases, of the wave. The reader decodes that tiny change. Gen2 calls this backscatter modulation; the reply encoding is FM0 or a Miller modulated subcarrier, chosen by the reader. The specification lists FM0 bit rates from 40 to 640 kbps and subcarrier rates from 5 to 320 kbps.

Two consequences follow. The link is half duplex, and the tag's reply is far weaker than the reader's carrier. An eavesdropper can therefore often hear the reader's commands from much further away than the tag's replies.

How are tag chips made, and what memory do they hold?

Fabrication

A tag chip goes through the same front end steps as any CMOS chip, from wafer to patterned transistors and metal layers, which our semiconductor explainer walks through. What is unusual is the economics. Tag chips are produced in the tens of billions: the RAIN Alliance's 2024 market report, prepared with VDC Research, projects RAIN tag chip shipments reaching 115 billion units by 2028, at an annual growth rate of 20.4 percent. At that volume every square micrometre counts, so designs keep logic minimal and spend effort on the analog front end that sets sensitivity.

Each die is probed and tested on the wafer, which is also where factory identity is written. The Gen2 specification requires the TID bank to begin with an ISO/IEC 15963 class identifier and states that for class E2h the first 32 bits of TID memory, holding the mask designer identifier and model number, "shall be permalocked at time of manufacture." Release 3.0.1 also states that tags shall support a serialised TID, either through class E0h, which carries a 48 bit serial number, or through class E2h with an extended TID containing a unique serial as defined in the Tag Data Standard.

The four memory banks

The Gen2 specification separates tag memory into four logical banks. The physical layout inside the chip is up to the manufacturer; readers address the logical map.

Three details in the specification shape security later:

1. Both passwords default to zero. The specification says the kill password's "default (unprogrammed) value shall be zero," and the same for the access password. A tag that does not implement a password behaves as though it has a zero password that is permanently locked.
2. A tag "shall not execute a password-based kill if its kill password is zero." So a tag that leaves the factory and the encoder with default passwords cannot be killed by password at the point of sale. Kill policy must be planned at encoding time.
3. The EPC bank's first word is a CRC computed by the tag. You cannot write it directly; the tag recomputes it whenever the EPC changes.

How are antennas made and dies attached?

Antennas on a roll

Inlay production is roll to roll: a continuous web of PET film moves through a sequence of stations. Two antenna methods dominate:

• Etching. Aluminium foil is laminated to PET. An etch resist is printed in the antenna pattern, the exposed aluminium is chemically etched away, and the resist is stripped. Aluminium is cheap and conductive enough for UHF.
• Printing. Conductive inks, usually silver, are printed in the antenna shape. This avoids etch chemistry, but higher resistance can cost read range.

The antenna must resonate near the regional band (around 866 MHz in Europe, 915 MHz in the United States, or both), match the chip's capacitive input and fit the label. The RAIN Alliance notes that a tag read at large distances is typically larger than one read close by.

Flip chip die attach

The die is attached face down across the antenna's two feed terminals, which is called flip chip. A common method uses anisotropic conductive adhesive (ACA) or paste (ACP): an adhesive filled with conductive particles that, once compressed between the chip's bumps and the antenna pads and cured with heat and pressure, conducts vertically through the squeezed particles but not sideways between the two terminals. Reliability of ACA bonded inlays has been studied in the electronics packaging literature, for example "Reliability of RFID tag inlay assembled by anisotropic conductive adhesive" at the 2008 Electronics System Integration Technology Conference and a 2007 study of flexible inlays packaged with ACA at the International Conference on Electronic Packaging Technology.

The strap route attaches dies to straps first, then straps to antennas with looser tolerances. Both end with a dry inlay roll.

Test and encode at speed

Every inlay is read on the line so bad positions on the roll can be marked or removed. Converters then add face stock and liner, and printer encoders write the EPC while printing text and a barcode. Line speeds vary by machine; we could not confirm a common published figure, so we do not quote one.

How does the Gen2 air protocol work?

A dated timeline of the standard

All dates below come from the version history in the Release 3.0.1 specification and the GS1 Gen2v3 fact sheet.

GS1's Gen2v3 fact sheet lists four goals: reducing "tag clutter" from other deployments, ignoring fringe tags that run out of power mid reply, smoothing multi reader sites, and simpler access to User or TID data.

Select: choose who should answer

Select matches a bit pattern against a memory bank, such as "EPCs with this company prefix," and sets flags on matching tags. Tags keep an inventoried flag (A or B) for each of four sessions, S0 to S3, plus a selected flag (SL), so two readers can inventory the same tags without undoing each other's progress.

Query and slotted anti collision

Next comes the inventory round. The reader sends Query with a parameter Q, an integer from 0 to 15. Each participating tag loads a random number between 0 and 2 to the power Q, minus 1, into its slot counter. A tag replies only when its counter reaches zero. The reader then advances slots with QueryRep, and each tag decrements its counter. The specification states the resulting response probabilities range from 1 (Q = 0) down to 2 to the power minus 15, about 0.000031.

When one tag replies in a slot, it sends a 16 bit random number (RN16); the reader echoes it in an ACK and the tag backscatters its PC, EPC and CRC. Collided tags retry later. Empty slots waste time too, so the reader tunes Q with QueryAdjust.

Worked example 1: picking Q for 200 tags. Suppose 200 tags are in the field. With Q = 8 there are 256 slots. The chance that a given slot holds exactly one tag is 200/256 times (255/256) to the power 199, which is about 0.359. So the round yields about 92 clean reads, about 117 empty slots and about 47 collided slots. With Q = 7 (128 slots), the singleton probability is about 0.328: only about 42 clean reads, 27 empty slots and 59 collisions. With Q = 9 (512 slots), there are about 136 clean reads but 346 empty slots wasted. The efficiency per slot peaks near 1/e, about 0.37, when the number of slots is close to the number of tags, which is why readers adapt Q toward the population size.

Access: reading and writing memory

After ACK, the reader sends Req_RN to get a handle for the conversation, then can Read and Write. With a nonzero access password, the Access command moves the tag to the secured state needed for Lock.

Passwords are cover coded: the reader XORs them with a random number the tag sent, and the tag XORs again. That hides the password from someone who hears only the reader, but the random number travels in the tag's backscatter, so a listener close to the tag can in principle recover it. The access password stops casual tampering; it is not a strong secret.

In Release 3.0.1, Req_RN, Read, ReadVar, Write, Lock and Kill are mandatory core access commands, while Access, BlockWrite, BlockErase, BlockPermalock and Untraceable are optional. Check the chip's datasheet before you design around an optional command.

Lock and permalock

Lock sets write protection per bank and read and write protection per password, either changeable with the access password or permalocked. Permalocking is irreversible.

Kill

Kill renders a tag permanently nonresponsive. The password based Kill is mandatory, and it requires a nonzero kill password, as noted above. Release 3.0.1 also defines an optional authenticated kill that uses a crypto suite instead of a password. NIST SP 800-98 describes the kill command as a privacy feature first: "the primary objective of the kill command is personal privacy."

Gen2v2 crypto suites and Authenticate

Gen2v2 added hooks for cryptography. The Challenge and Authenticate commands carry an 8 bit Cryptographic Suite Indicator (CSI). The top four bits name the assigning authority: values 0000 to 0011 mean ISO/IEC 29167, 1101 means the tag manufacturer, and 1110 means GS1. The bottom four bits pick one of 16 suites from that authority. ISO/IEC 29167 is a family of parts, each defining an air interface security suite. A tag with a suite can prove it holds a secret key without revealing it, which closes the cloning gap a static EPC leaves. The E2h TID's S bit tells a reader whether the tag supports Authenticate or Challenge. Crypto capable chips cost more silicon and reader time, so they appear where authenticity outweighs price.

Untraceable

Untraceable is the Gen2 privacy middle ground between "live" and "dead." The specification says an interrogator with the Untraceable privilege can instruct a tag to alter the length and U bits of its EPC, "hide memory from Interrogators with a deasserted Untraceable privilege," and/or "reduce its operating range for all Interrogators." The hideable memory includes part or all of the EPC, the serial part of the TID or the whole TID, and User memory. A tag only executes Untraceable in the secured state, which means the access password, or a crypto authentication, gates it.

A retailer can thus shrink a sold item's EPC to the product class, hide the TID serial and reduce range. The tag still works for returns but no longer broadcasts a unique number across the street.

How is identity encoded?

The EPC Tag Data Standard

The GS1 EPC Tag Data Standard (TDS) defines the EPC schemes, their URI forms, and their exact binary encodings in the EPC bank. The current release is 2.3, ratified in October 2025, which added twelve new "plus plus" schemes such as SGTIN++. The most common scheme on retail items is the Serialised Global Trade Item Number (SGTIN), which is the barcode GTIN plus a serial number.

Worked example 3: encoding an SGTIN-96. The TDS includes this example in its Annex E. Start from the GS1 element string (01) 09506000134352 (21) 6789, which is a GTIN plus serial 6789.

1. Split the GTIN. The GS1 Company Prefix here is 95060001343, the indicator digit 0 and item reference 5 combine to 05, and the check digit 2 is dropped.
2. The pure identity URI is urn:epc:id:sgtin:95060001343.05.6789.
3. Choose a filter value. Filter 3 is used in the TDS example, and the tag URI becomes urn:epc:tag:sgtin-96:3.95060001343.05.6789.
4. Encode to 96 bits: header 00110000 (SGTIN-96), filter 011, partition 101 (meaning an 11 digit company prefix in 37 bits and a 2 digit item reference in 7 bits), the company prefix, item reference 0000101, and a 38 bit serial.
5. By our arithmetic from those fields, the 96 bits written to the tag in hexadecimal are 3076C4409047E14000001A85.

The TDS notes that SGTIN-96 only works when the serial is numeric, has no leading zero, and is below 2 to the power 38 (274,877,906,944). Anything else needs SGTIN-198, which has room for alphanumeric serials. The URI is the same either way.

The filter value codes the packaging level, so a distribution centre reader can Select cases and ignore the items inside.

The TID is a factory serial, not a secret

The TID carries the chip maker's ID, model and a unique serial. Being factory permalocked, it is harder to change than the EPC, so pairing EPC and TID catches simple copies. But it is static and readable by anyone, so an emulator can replay it. TID checks raise the bar; they do not prove authenticity.

Why an EPC alone is not an authenticator

An EPC is a number any reader can read and any blank tag can carry. Copying it is just normal encoding. In "EPC RFID tag security weaknesses and defenses," presented at ACM CCS in November 2009, Koscher, Juels, Brajkovic and Kohno studied the UHF Gen2 tags in the US passport card and enhanced driver's licences. They described how those identifiers could be read at a distance and copied, and discussed defences. An EPC says what an item claims to be; only cryptographic authentication can prove it. If "the EPC is in our database" means genuine, one read item lets a counterfeiter tag a thousand fakes. Duplicate checks help, but only after the fact. Our post on counterfeit electronic parts and how an HBOM helps covers the same problem for components.

How do radio rules shape a tag's range?

The reader is the regulated transmitter, and its power limit sets how far away a passive tag can wake.

United States: 47 CFR 15.247

In the United States, UHF readers usually operate as frequency hopping systems under 47 CFR 15.247 in the 902 to 928 MHz band. The rule requires at least 50 hopping frequencies, with occupancy on any one frequency no more than 0.4 seconds within a 20 second period when channels are narrower than 250 kHz. The maximum peak conducted output power is 1 watt for systems with at least 50 hopping channels. That limit assumes antennas with directional gain of no more than 6 dBi; above that, the conducted power must drop by the amount the gain exceeds 6 dBi.

Europe: ETSI EN 302 208

In Europe, ETSI EN 302 208 V3.4.1 (December 2023) is the harmonised standard for RFID equipment. Its scope covers 865 to 868 MHz with power up to 2 W e.r.p. and 915 to 921 MHz with power up to 4 W e.r.p. e.r.p. is referenced to a half wave dipole and EIRP to an isotropic antenna; they differ by 2.15 dB.

Worked example 4: converting limits. In the US, 1 W conducted is 30 dBm. Add a 6 dBi antenna and the EIRP is 36 dBm, or 4 W. If an installer uses an 8 dBi antenna, the conducted power must fall by 2 dB, to 28 dBm, about 0.63 W, so the EIRP stays at 36 dBm. In Europe's lower band, 2 W e.r.p. is 33 dBm e.r.p., which is about 35.2 dBm EIRP, or about 3.28 W EIRP. The two regions end up in the same neighbourhood.

Worked example 5: a free space power budget. This is an illustration, not a datasheet value. At 915 MHz, the wavelength is about 0.328 m. Free space path loss is 20 times log10 of (4 pi d divided by wavelength). At 10 m, that is about 51.7 dB. With 36 dBm EIRP and a tag antenna gain of 2 dBi, the power reaching the chip is roughly 36 minus 51.7 plus 2, or about minus 13.7 dBm. At 20 m it is about minus 19.7 dBm. If a hypothetical chip needs minus 20 dBm to wake, free space would allow about 20 m. Real sites lose more to cables, polarisation and the item's material, so practical ranges are shorter, but the arithmetic shows why a determined reader can reach further than people expect.

What are the privacy issues?

Tracking after purchase

A sold item still carries a globally unique serial. If the tag stays live, anyone with a UHF reader can read it as the item passes, and if the number links to a purchase or loyalty record, the item becomes a proxy for its owner. Even unlinked, a unique number seen at different places can be correlated. Ari Juels' 2006 survey "RFID security and privacy: a research survey," in IEEE Journal on Selected Areas in Communications, framed this as two linked problems: privacy (what a tag reveals) and authentication (whether a tag can be cloned).

NIST SP 800-98, "Guidelines for Securing Radio Frequency Identification (RFID) Systems," published in April 2007, says RFID tags could potentially be used to track individuals and that the kill command's primary objective is personal privacy. It recommends combined management, operational and technical controls. It predates Gen2v2 and Untraceable, so treat it as foundational guidance.

Kill, Untraceable and the "live for returns" tension

Killing a tag at checkout protects the shopper but removes its value for returns, warranty and recycling. Untraceable fits this case: hide the serial and shrink range while keeping the tag alive. Which option a program uses is a policy choice shoppers rarely see.

Research on consumer side controls

Academic work has explored defences that do not depend on the retailer. In "The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy," presented at ACM CCS in 2003, Juels, Rivest and Szydlo proposed a device that disrupts the anti collision process for a selected range of identifiers, so readers cannot enumerate the shopper's tags while tags in a store's own range keep working. It framed privacy as control over which tags answer, not all or nothing.

Item level tagging in practice

GS1's Gen2v3 fact sheet notes that industry has deployed RAIN item level tagging in apparel at large scale "for many years," and is expanding into rail, aerospace and defence, consumer electronics, pharmaceuticals, food services, automotive and more.

Practical privacy guidance for an organisation deploying item level RFID:

• Tell customers where tags are and what happens at checkout.
• Put tags on removable hang tags rather than sewn in labels where possible.
• Prefer chips with Untraceable for consumer items, and use it at the point of sale.
• If you kill tags, set nonzero kill passwords at encoding.
• Keep read logs short and do not join them to customer identities without consent.

Step by step: read and encode tags with an LLRP reader

This walkthrough uses LLRP, the Low Level Reader Protocol (version 1.1, EPCglobal, October 2010), and sllurp, an open source Python LLRP client under GPL version 3. Commands come from the sllurp README and command line source.

Warning: writing passwords, locking or killing tags changes them permanently. A permalocked bank cannot be unlocked, and a killed tag cannot be revived. Practise on spare tags. Before every write, confirm you are talking to exactly one tag by its TID, and keep other tags out of the field.

1. Install the client in a virtual environment

python3 -m venv .venv
source .venv/bin/activate
pip install sllurp
sllurp --help

2. Confirm the reader is reachable and isolated

LLRP 1.1 uses TCP port 5084 by default and 5085 for TLS. Keep readers on a management segment and check what answers.

nc -vz 10.20.0.15 5084
nc -vz 10.20.0.15 5085

If only 5084 answers, the reader offers no TLS on the default port; firewall it so only middleware hosts can connect.

3. Run an inventory

sllurp inventory 10.20.0.15 -t 5 -a 1 -P 4

Here -t is seconds to inventory, -a picks the antenna, and -P passes an estimated tag population to the reader. If more than one EPC appears, remove the extra tags before writing.

4. Read and verify the TID

Read the first six words (96 bits) of the TID bank (bank 2).

sllurp access 10.20.0.15 -mb 2 -wp 0 -r 6

Check the first byte is E2 or E0 and record the TID. This is your target check: every later write must hit this one tag, so repeat this read before each write and filter on the TID where your software allows.

5. Read the EPC bank and the Reserved bank

sllurp access 10.20.0.15 -mb 1 -wp 0 -r 8
sllurp access 10.20.0.15 -mb 0 -wp 0 -r 4

The Reserved bank holds the kill password (words 0 and 1) and access password (words 2 and 3). If you can read them, they are not read locked.

6. Write the EPC

Write six words from word 2 of the EPC bank (word 0 is the CRC, word 1 the PC). sllurp reads the data from standard input.

printf '%s' '3076C4409047E14000001A85' | xxd -r -p | \
  sllurp access 10.20.0.15 -mb 1 -wp 2 -w 6

Re-run step 3 and confirm the new EPC is reported.

7. Set the access and kill passwords

Generate random per tag passwords, store them in your back end keyed by TID, and never print them on the label.

# generate 8 random bytes: 4 for kill, 4 for access
openssl rand -hex 8

Write those 8 bytes (four words) to bank 0 starting at word 0, using the same pattern as step 6 with -mb 0 -wp 0 -w 4. Then read bank 0 again to confirm. From now on, pass the access password to sllurp as an integer, for example -ap $((16#A1B2C3D4)) for a hex value.

8. Lock memory

Locking uses the Gen2 Lock command, carried in LLRP as a C1G2Lock operation in an AccessSpec. The sllurp command line covers reads and writes only, so use your reader's LLRP tool or middleware library. A typical policy:

After locking, verify by trying to read bank 0 with access password 0. The read should fail. Then read it with the correct access password via -ap (sllurp takes an integer) and confirm it succeeds.

9. Decide the end of life action

Document whether tags are killed, made untraceable or left live, and test on a sample. Kill needs a nonzero kill password; Untraceable needs a chip that supports it.

Common mistakes

• Leaving the access password at zero. A zero access password means any reader can reach the secured state on a tag that has no other protection. It also means locks set with a zero password provide little real protection.
• Trusting the EPC for authentication. EPCs are copyable by design. Use cryptographic authentication through an ISO/IEC 29167 suite, or treat RFID as an inventory tool and not a proof of authenticity.
• No kill policy. Teams discover at the till that tags cannot be killed because the kill password was never set, or that killing tags breaks returns. Decide before encoding.
• Permalocking by accident. A test script that permalocks the EPC bank as unwritable turns a whole roll into scrap. Test lock scripts on single tags.
• Exposing readers on flat networks. Readers are networked computers with web consoles, LLRP ports and firmware. Put them on a management segment, use TLS where offered, and change default credentials on the reader itself.
• Writing to the wrong tag. In a field with several tags, a write can hit whichever tag is singulated first. Isolate the tag and filter on TID.
• Publishing EPC reads with personal data. Joining EPC read logs to loyalty or payment records turns inventory data into personal data and raises legal duties.

FAQ

How is an RFID tag made?

A chip is fabricated on a silicon wafer, tested and programmed with a factory identifier, then cut into dies. Antennas are etched from aluminium on PET film or printed with conductive ink on a roll. Each die is flipped and bonded across the antenna feed with conductive adhesive to form an inlay, which is tested, laminated into a label and encoded with an EPC.

What is RAIN RFID?

RAIN RFID is the industry name for passive UHF RFID that uses the GS1 EPC Gen2 air interface, harmonised with ISO/IEC 18000-63. The RAIN Alliance promotes it. It operates in regional slices of 860 to 960 MHz and is used mainly to identify items, cases and pallets.

Do RFID tags have batteries?

Passive UHF tags do not. They harvest power from the reader's signal and answer by backscatter. Battery assisted passive tags use a battery to run the chip but still answer by backscatter. Active tags have a battery and their own transmitter.

Can RFID tags be cloned?

A standard EPC can be copied to another tag because it is just a number in writable memory. Tags that support an ISO/IEC 29167 crypto suite can prove they hold a secret key, which a copy cannot do without the key.

What does the kill command do?

It permanently disables the tag so it never responds again. It needs a nonzero 32 bit kill password, or an authenticated kill on tags that support crypto suites.

What is the Untraceable command?

An optional Gen2 command that lets an authorised reader hide part or all of the EPC, the TID serial or User memory, and reduce read range, while keeping the tag usable for authorised readers.

Can my phone read UHF RFID tags?

Phone NFC radios work at 13.56 MHz and cannot read UHF RAIN tags. Reading UHF tags needs a UHF reader, such as a handheld or a reader that pairs with a phone.

Is RFID regulated for privacy?

Radio rules (FCC Part 15 in the US, ETSI EN 302 208 in Europe) cover the reader's emissions, not data. Privacy duties come from general data protection and consumer laws, and from guidance such as NIST SP 800-98.

Where Safeguard fits, honestly

Safeguard does not make, test or encode tags, does not analyse hardware, reader firmware or radio behaviour, and does not generate hardware bills of materials.

The overlap is the software around RFID. Middleware that receives LLRP reports, inventory services, EPCIS event repositories, mobile apps for handheld readers and the scripts that encode labels are code your teams build with open source dependencies. If that code lives in repositories or container images, Safeguard can scan it (for example safeguard scan --dir . on a checkout or safeguard scan --image followed by an image name), match components against vulnerability databases, rank findings with reachability analysis, evaluate policies and gates, and open fix pull requests when you switch autonomous remediation on.

Encoding tools and reader middleware pull in open source LLRP clients, XML and JSON parsers and web frameworks, and readers themselves ship firmware built from open source components. The section below is our standard remediation guidance for the dependencies you build and ship around tags, not for the tags themselves.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation covers eight categories, including dependencies, licenses, security posture and findings. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds. The safeguard-sh/gold-scan-action GitHub Action can fail a build on a known exploited vulnerability, on any known vulnerability, or never, so a version you have just removed cannot quietly come back in next week's merge.

3. Gold Registry: start from components that are already fixed

registry.safeguard.sh provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs, zero malware and a completed license check, with SLSA L3 or higher provenance, a Sigstore signature and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. This fork and patch flow is in early access today, so ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo is a real Safeguard CLI session asked to fix a lodash CVE. It reads the finding and advisory, asks before any command that changes something, edits package.json to lodash 4.17.21, runs npm install and npm test with approval, and pushes nothing. The same flow fits a JavaScript dashboard or web service that displays RFID inventory reads.

Click through it at your own pace, or open it full screen.

The second demo sets up the Safeguard runner on your own machine, approves it with its device code and scans from the terminal. Teams that keep label encoding scripts and reader middleware inside a plant or warehouse network can scan them locally the same way.

Click through it at your own pace, or open it full screen.

The third demo connects Claude to the Safeguard MCP server with OAuth and shows how you choose which tools Claude can use. A team asking an assistant about its EPCIS or inventory services can limit it to the read and scan tools it needs.

Click through it at your own pace, or open it full screen.

To try it on your own repositories, download Safeguard and follow the CLI documentation.

Quick check

Sources

• GS1, EPC UHF Gen2 Air Interface Protocol (standard page)
• GS1, Gen2 UHF RFID Standard, Release 3.0.1 (Feb 2026)
• GS1, Gen2v3 Fact Sheet, What's new in Gen2v3 (Jan 2024)
• GS1, EPC Tag Data Standard (standard page)
• GS1, EPC Tag Data Standard, Release 2.3 (Oct 2025)
• GS1, Low Level Reader Protocol 1.1 (standard page)
• EPCglobal, Low Level Reader Protocol 1.1 specification (Oct 2010)
• RAIN Alliance, home page
• RAIN Alliance, What is RAIN: Tags
• RAIN Alliance, RAIN 2024 Market Report
• NIST SP 800-98, Guidelines for Securing RFID Systems (publication page)
• NIST SP 800-98, full text PDF
• eCFR, 47 CFR 15.247
• ETSI EN 302 208 V3.4.1 (2023-12)
• Juels, Rivest and Szydlo, The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy, ACM CCS 2003
• Juels, RFID security and privacy: a research survey, IEEE JSAC 24(2), 2006
• Koscher, Juels, Brajkovic and Kohno, EPC RFID tag security weaknesses and defenses, ACM CCS 2009
• Reliability of RFID tag inlay assembled by anisotropic conductive adhesive, ESTC 2008
• Reliability evaluation on flexible RFID tag inlay packaged by ACA, ICEPT 2007
• sllurp, pure Python LLRP client (README and source)

Last reviewed: 25 October 2026.